Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Oct 24, 2026Prime Mover – Backup and Migration: PHP Object InjectionCVE-2026-115806 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.
- Product
- Prime Mover – Backup and Migration
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Prime Mover – Backup and Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026The Prime Mover: Stored cross-site scriptingCVE-2026-101890 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.
- Product
- The Prime Mover
- Fixed in
- 2.2.1
- What to do
- Update The Prime Mover to 2.2.1 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Oct 1, 2026The Prime Mover: Path traversalCVE-2026-101889 · WordPress plugins & themes · reported by VulnCheckHigh 7
The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable.
- Product
- The Prime Mover
- Fixed in
- 2.2.1
- What to do
- Update The Prime Mover to 2.2.1 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Oct 1, 2026The Prime Mover: Zip Slip path traversalCVE-2026-101888 · WordPress plugins & themes · reported by VulnCheckHigh 8.6
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.
- Product
- The Prime Mover
- Fixed in
- 2.2.1
- What to do
- Update The Prime Mover to 2.2.1 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
May 27, 2026WP Meta and Date Remover: Missing AuthorizationCVE-2026-49051 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Meta and Date Remover: from n/a through 2.3.6.
- Product
- WP Meta and Date Remover
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update WP Meta and Date Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025User Spam Remover: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Joel User Spam Remover user-spam-remover allows Retrieve Embedded Sensitive Data.This issue affects User Spam Remover: from n/a through <= 1.1.
- Product
- User Spam Remover
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update User Spam Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Broken Links Remover: Cross-Site Request Forgery (CSRF)CVE-2025-39440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover: from n/a through <= 1.2.2.
- Product
- Broken Links Remover
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Broken Links Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Empty Tags Remover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24640 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan-Lucian Stefancu Empty Tags Remover empty-tags-remover allows Reflected XSS.This issue affects Empty Tags Remover: from n/a through <= 1.0.
- Product
- Empty Tags Remover
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Empty Tags Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Comment Date and Gravatar remover: Cross-Site Request Forgery (CSRF)CVE-2025-28862 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request Forgery.This issue affects Comment Date and Gravatar remover: from n/a through <= 1.0.
- Product
- Comment Date and Gravatar remover
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Comment Date and Gravatar remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Meta and Date Remover: Missing AuthorizationCVE-2023-47836 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in prasadkirpekar WP Meta and Date Remover wp-meta-and-date-remover allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meta and Date Remover: from n/a through <= 2.3.0.
- Product
- WP Meta and Date Remover
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WP Meta and Date Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Visual Footer Credit Remover: Stored Cross-Site ScriptingCVE-2024-2846 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Visual Footer Credit Remover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'selector' parameter in all versions up to, and including, 2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Visual Footer Credit Remover
- Affected
- up to 2
- What to do
- Affects up to 2. Update Visual Footer Credit Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024Admin Bar Remover: Unauthorized modification of dataCVE-2024-1716 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Admin Bar Remover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_form() function in all versions up to, and including, 1.0.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to enable or disable the admin bar on the front-end of the site.
- Product
- Admin Bar Remover
- Affected
- up to 1.0.2.2
- What to do
- Affects up to 1.0.2.2. Update Admin Bar Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 10, 2024User Spam Remover: Insertion of Sensitive Information into Log FileCVE-2024-31298 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.
- Product
- User Spam Remover
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update User Spam Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2023WP Meta and Date Remover: Provides an AJAX endpoint for configuring the plugin settingsCVE-2023-4823 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.
- Product
- WP Meta and Date Remover
- Fixed in
- 2.2.0
- What to do
- Update WP Meta and Date Remover to 2.2.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.